PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertion that have been signed.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature
    wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and
    the node/object that is signed can be in different places and thus the signature verification will
    succeed, but the wrong data will be used. This specifically affects the verification of assertion that
    have been signed. (CVE-2020-5390)

It was discovered that pysaml2, a Python implementation of SAML to be used in a WSGI environment, was susceptible to XML signature wrapping attacks, which could result in a bypass of signature verification.

For Debian 8 'Jessie', this problem has been fixed in version 2.0.0-1+deb8u3.

We recommend that you upgrade your python-pysaml2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that pysaml2, a Python implementation of SAML to be used in a WSGI environment, was susceptible to XML signature wrapping attacks, which could result in a bypass of signature verification.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4245-1 advisory.

    It was discovered that PySAML2 incorrectly handled certain SAML files. An attacker could possibly use this     issue to bypass signature verification with arbitrary data.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
422693	SCA: security update for pysaml2 (GHSA-qf7v-8hj3-4xw7)	Tenable Cloud Security	SCA Checks	Local	high
422693	SCA: security update for pysaml2 (GHSA-qf7v-8hj3-4xw7)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
134092	Debian DLA-2119-1 : python-pysaml2 security update	Nessus	Debian Local Security Checks	Local	high
133878	Debian DSA-4630-1 : python-pysaml2 - security update	Nessus	Debian Local Security Checks	Local	high
133179	Ubuntu 16.04 LTS / 18.04 LTS : PySAML2 vulnerability (USN-4245-1)	Nessus	Ubuntu Local Security Checks	Local	high

Detections

Analytics

CVE-2020-5390

high

Tenable Plugins

high

high

high

high

high